How to Eliminate Crbr Encryptor Ransomware

What is Crbr Encryptor ransomware? And how does it work?

Crbr Encryptor ransomware is a slightly modified strain of the Cerber Trojan which was known as a dangerous threat. Malware developers like the ones behind Cerber ransomware, tend to upgrade their intrusive programs to fix any possible flaws and to create further destruction. At the moment of writing, this ransomware is still on the loose. It scans your computer for certain file types listed below:
.r3d, .rwl, .rx2, .p12, .sbs, .sldasm, .wps, .sldprt, .odc, .odb, .old, .nbd, .nx1, .nrw, .orf, .ppt, .mov, .mpeg, .csv, .mdb, .cer, .arj, .ods, .mkv, .avi, .odt, .pdf, .docx, .gzip, .m2v, .cpt, .raw, .cdr, .cdx, .1cd, .3gp, .7z, .rar, .db3, .zip, .xlsx, .xls, .rtf, .doc, .jpeg, .jpg, .psd, .zip, .ert, .bak, .xml, .cf, .mdf, .fil, .spr, .accdb, .abf, .a3d, .asm, .fbx, .fbw, .fbk, .fdb, .fbf, .max, .m3d, .dbf, .ldf, .keystore, .iv2i, .gbk, .gho, .sn1, .sna, .spf, .sr2, .srf, .srw, .tis, .tbl, .x3f, .ods, .pef, .pptm, .txt, .pst, .ptx, .pz3, .mp3, .odp, .qic, .wps.

This newly improved version appears to behave just like the old version except for the encryption process since the encrypted files are marked with a sequence of four random characters and it shows a program named Crbr Encryptor Instructions which contains the ransom note. The ransom note contains the following message:
“Hi, I’am CRBR ENCRYPTOR 😉
—–
YOUR DOCUMENTS, PHOTOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
—–
The only way to decrypt your files is to receive the private key and decryption program.
To receive the private key and decryption program go to any decrypted folder,
inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions
how to decrypt your files.
If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below:
—–

Download “Tor Browser” from https://www.torproject.org/ and install it.
In the “Tor Browser” open your personal page here:

http://xpcx6erilkjced3j.onion/[victim_id]
Note! This page is available via “Tor Browser” only.
—–
Also you can use temporary addresses on your personal page without using “Tor Browser”.
—–

http://xpcx6erilkjced3j.1t2jhk.top/[victim_id]
http://xpcx6erilkjced3j.1e6ly3.top/[victim_id]
http://xpcx6erilkjced3j.1ewuh5.top/[victim_id]
http://xpcx6erilkjced3j.15ezkm.top/[victim_id]
http://xpcx6erilkjced3j.16umxg.top/[victim_id]

—–
Note! These are temporary addresses! They will be available for a limited amount of time!”

After is successfully infect your computer, the Crbr Encryptor ransomware creates and drops files named _R_E_A_D__T_H_I_S__{RAND}_.hta and _R_E_A_D__T_H_I_S__{RAND}_.txt which contains more information about the ransomware. Unsurprisingly, you might panic when you see these files on your computer and may delete it right away, that’s actually not a wise move. Doing so may even corrupt your other files, so to remove this ransomware, you must first decontaminate its executable file that is currently running on your computer system. Moreover, it also establishes itself by creating registry entries needed for its functionality and creates numerous points of execution to make sure that Crbr ransomware runs whenever you start your PC.

How is Crbr Encryptor distributed?

Crbr Encryptor drops its payload file using suspicious and corrupted sites with the Magnitude Exploit Kit, macro-enabled Microsoft Word documents, PDF files with a second extension are secretly programs in disguise. This kind of distribution technique exploits outdated, unsupported and overall vulnerable software and injects malicious components on your computer whenever you visit suspicious websites that hosts such exploit kits.
Additionally, this ransomware is also distributed through malicious spam emails. The perpetrators behind this ransomware pretends to deliver emails from Microsoft Security team and will inform you about a suspicious log in activity on your supposedly Microsoft account.
Follow the removal instructions below to get rid of the Crbr Encryptor ransomware:

Hold down Windows + E keys simultaneously to open File Explorer.

Select and remove a randomly entitled malicious .exe file in the following folders:

C:\Users\<your username>\AppData\Roaming
C:\Users\<your username>\Downloads

Select and remove a randomly entitled malicious .lnk file in the following folders:

C:\Users\<your username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
C:\ProgramData\Start Menu\Programs
C:\ProgramData\Microsoft\Windows\Start Menu\Programs
C:\ProgramData\Application Data\Microsoft\Windows\Start Menu\Programs

Click the Windows button.

Type in regedit into the search box and then press Enter.

Select and remove a randomly entitled malicious registry value in the following directories:

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun .
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Control Panel\Desktop

Empty your Recycle Bin.

Open Windows Task Manager by pressing Ctrl + Shift + Esc at the same time.

Go to the Processes tab and look for any suspicious processes and then kill them.

Open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.

Look for Crbr Encryptor ransomware or any suspicious program and then Uninstall.

Try to recover your encrypted files.

Restoring your encrypted files using Windows’ Previous Versions feature will only be effective if the Crbr Encryptor ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot.
To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.

Follow the continued advanced steps below to ensure the removal of the Crbr Encryptor ransomware:
Perform a full system scan using SpyRemover Pro.

Turn on your computer. If it’s already on, you have to reboot

After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit

Windows will now load the Safe Mode with Networking.

Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.

Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading SpyRemover Pro. Installation will start automatically once download is done.